Bubbles — Privacy Policy

Last updated: 27 September, 2026

This Privacy Policy explains how Xiaoshuai Song trading as Songable Studio (“Songable Studio”, “we”, “us” and “our”) collects, holds, uses and discloses personal information in connection with the Bubbles mobile application, website and related services (“Bubbles” or the “Service”).

We handle personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles, the Health Records Act 2001 (Vic) and other applicable privacy, health-information and consumer laws, to the extent those laws apply to us.

1) What this policy covers

This Privacy Policy explains:

• what personal, health and technical information we collect;
• why and how we use it;
• when we disclose it to service providers and other parties;
• where information may be stored or processed;
• how long we retain it;
• how we protect it;
• your choices, access and correction rights; and
• how to make a privacy complaint.

This Policy applies to the Bubbles mobile application and to the Bubbles website. Some provisions apply only to the mobile app or only to the website, as identified below.

Bubbles is intended for adults aged 18 years and over. It is a general wellbeing and self-reflection service and is not a medical or mental health service.

2) Who we are

Bubbles is operated by:

Xiaoshuai Song trading as Songable Studio
ABN: 89 831 726 266
PO Box 2040, Brunswick East, Victoria 3057, Australia
Telephone: +61 457 060 286
Email: help@mybubbles.com.au

Bubbles is the product name of the Service. It is not a separate legal entity.

3) Information we collect

We collect information directly from you, automatically through your use of the Service, from your device where you grant permission, and from third parties such as App Store Providers and service providers.

A. Account and profile information

Depending on how you use Bubbles, we may collect:

• an anonymous account, session or user identifier;
• your email address;
• authentication and account-recovery information;
• an optional display name;
• an optional profile photograph;
• account status and onboarding completion information;
• your settings, preferences and consent records; and
• information you provide when contacting support.

You may be able to begin using selected Bubbles features as an anonymous guest. We may create or use an anonymous account, session identifier or device-linked identifier so that the guest experience can operate and, where supported, continue.

If you later create or claim an account, information associated with the guest experience may be linked or transferred to the claimed account where the app supports that process and it can be done safely.

B. Check-ins, reflections and other wellbeing information

Depending on the features you use, we may collect information such as:

• mood, energy and related ratings;
• check-in responses and selected context;
• reflection, journal, note and direction text;
• tags, themes, activities and preferences;
• guided-support selections, progress and completion history;
• post-support feedback, including whether a support felt better, the same, worse or uncertain;
• dates, times, time-zone information and reminder settings; and
• trends, summaries and insights derived from your use of Bubbles.

Depending on the feature and your account state, some information may be stored locally on your device, remotely through our service providers, or both. Remote storage may be used for account continuity, synchronisation, backup, trends, personalisation, support and other app functionality.

Mood, energy, reflections and other wellbeing information may be personal information and, depending on its content and context, may also constitute health information or sensitive information.

C. Profile photographs

If you choose to add a profile photograph, Bubbles accesses the photograph you select for the purpose of uploading, storing and displaying it as your profile image. Bubbles does not require access to your entire photo library where your device permits you to select a specific photograph.

D. Device, usage and diagnostic information

When you use Bubbles, we may collect limited technical and usage information, including:

• device type, model and operating-system version;
• app version, language and general configuration;
• anonymous or pseudonymous device and app identifiers;
• authentication events, login times and session status;
• screens or features used, interaction events and session duration;
• network and connectivity status relevant to app operation;
• crash logs, diagnostic events, performance data and error reports; and
• security, fraud-prevention and abuse-detection information.

We seek to limit diagnostic information to what is reasonably necessary to operate, secure, troubleshoot and improve the Service. We do not intend diagnostic tools to capture the contents of your private reflections or journal entries.

E. Subscription and transaction information

If you subscribe to Bubbles Plus (Bubbles+) through Apple’s App Store, Google Play or another authorised provider, the App Store Provider processes your payment.

We do not receive your full payment-card details. We may receive limited information such as:

• subscription and entitlement status;
• plan and product identifiers;
• purchase, renewal and expiry dates;
• trial, offer or promotional eligibility;
• transaction and receipt identifiers; and
• refund, cancellation or billing-status information.

We may use a subscription-management provider, currently RevenueCat, to help validate purchases and manage entitlements.

F. Communications and support

If you contact us, we may collect:

• your name and contact details;
• the content of your enquiry or complaint;
• screenshots, logs or attachments you choose to provide;
• support history and resolution notes; and
• records needed to investigate security, billing, account or privacy issues.

4) Health and wellbeing information

What health information may be accessed

If you enable Health Context or another supported health feature on iOS, Bubbles may request access through Apple Health and HealthKit to information you authorise, such as:

• sleep information;
• step counts; and
• exercise or workout-duration information.

If Bubbles introduces additional health-data types in the future, the app will request the relevant permission and this Policy or the applicable collection notice will be updated before those types are used.

If Bubbles is later offered on Android with Health Connect or another health platform, equivalent principles will apply and the relevant permissions and collection notices will be presented.

Why health information is collected

Where you choose to provide it, health information may be used to:

• display Health Context information within Bubbles;
• help you view relevant patterns alongside your check-ins and wellbeing activity;
• support permitted personalisation of suggestions and insights;
• improve the reliability of health-enabled features; and
• operate the health feature consistently with your settings and permissions.

What happens if you do not provide health information

You can use Bubbles without connecting Apple Health or another health service. If you do not grant permission, Health Context and related health-enabled features may be unavailable, show less information or provide less personalised context. Your access to the core Bubbles experience is not conditional on providing health information.

Withdrawing health consent

You may withdraw or change health permissions at any time:

• through Bubbles settings, where a relevant control is provided;
• through the Apple Health app or iOS Settings; or
• through the connected health service on another supported platform.

Withdrawing permission stops future access to health information through that permission. It does not automatically delete health information or derived summaries already lawfully stored by Bubbles. You may separately request deletion of stored information or delete your account, subject to lawful retention requirements.

We do not sell health information, use it for advertising, or provide it to data brokers.

5) How we use information

We may use personal information to:

• create, authenticate, secure and administer accounts;
• provide guest access and account-continuity features;
• operate check-ins, guided supports, reflections, reminders, trends and other features;
• display, synchronise, back up or export your information where supported;
• provide personalisation, recommendations, summaries and insights;
• process subscription entitlements, trials, offers, referrals and complimentary access;
• respond to enquiries, support requests, privacy requests and complaints;
• send security, account, legal, subscription and service communications;
• detect, investigate and prevent fraud, misuse, security threats and unlawful activity;
• debug, maintain, analyse and improve the Service;
• comply with legal, regulatory, accounting and App Store obligations; and
• establish, exercise or defend legal claims.

We will not use personal information for a materially different purpose without an appropriate legal basis, notice or consent where required.

6) Automated personalisation and artificial intelligence

Bubbles may use rules, statistical methods, recommendation logic and other automated processing to organise information, identify possible patterns and suggest supports that may be relevant to your current state or prior feedback.

Automated suggestions are general wellbeing features. They are not clinical assessments, diagnoses, treatment decisions or decisions that produce legal or similarly significant effects.

Current position on generative artificial intelligence

Bubbles does not currently send identifiable reflection text, journal entries, mood information or health information to a third-party generative-AI provider for analysis.

We do not currently use personal information from Bubbles to train third-party large language models or external generative-AI models.

Before introducing a feature that sends personal, reflection or health information to an external AI provider, we will update this Policy and relevant collection notices, identify the purpose and provider, explain whether information is identifiable, explain whether model training is permitted, identify relevant processing locations, and obtain consent where required.

7) How we disclose information

We do not sell personal information.

We do not sell or disclose health information for advertising, cross-context behavioural advertising or data-broker purposes.

A. Service providers

We may disclose information to providers that help us operate Bubbles, including providers of:

• authentication, cloud hosting and database services, currently including Supabase;
• subscription and entitlement management, currently including RevenueCat;
• App Store distribution and payment processing, including Apple and, if offered, Google;
• email delivery and customer communications;
• website hosting and content delivery;
• analytics, performance monitoring and crash reporting;
• security, fraud prevention, backup and technical support; and
• legal, accounting, insurance and professional advice.

We seek to provide service providers only with information reasonably necessary for their role and to use contractual, technical and organisational safeguards appropriate to the nature of the information.

B. App Store Providers

Apple, Google and other App Store Providers independently handle payment, device-account and store information under their own terms and privacy policies. We receive only the limited subscription and transaction information needed to operate entitlements and support purchases.

C. Legal, safety and security disclosures

We may disclose information where reasonably necessary or required to:

• comply with law, a court order, subpoena or lawful government request;
• investigate or prevent fraud, abuse, security threats or unlawful activity;
• protect the rights, safety or property of users, Songable Studio or another person;
• respond to an emergency where disclosure is permitted by law; or
• establish, exercise or defend legal claims.

D. Business transactions

If Bubbles or Songable Studio is involved in a proposed or completed sale, merger, restructure, financing, transfer of assets or succession to another operator, personal information may be disclosed to professional advisers and relevant parties, subject to appropriate confidentiality and privacy safeguards.

8) International processing and disclosure

Some service providers and their subprocessors may store or process information outside Australia.

Depending on the provider and its configuration, information may be processed in:

• Australia;
• the United States;
• countries in the European Union or European Economic Area; and
• other countries in which a provider or its authorised subprocessors operate support, security or infrastructure services.

The specific countries may change as providers update infrastructure or subprocessors. Where practicable, we assess material providers and processing locations and update this Policy when a material change affects how personal or health information is handled.

Where Australian privacy law applies to an overseas disclosure, we take reasonable steps appropriate to the circumstances to require the recipient to protect the information consistently with applicable Australian privacy requirements, subject to lawful exceptions.

9) Aggregate and de-identified information

We may create aggregated or de-identified information from personal information for purposes such as:

• analysing how features perform;
• improving reliability, usability and wellbeing supports;
• understanding general trends and usage patterns;
• planning and measuring the Service; and
• preparing high-level business or operational reports.

We take reasonable steps intended to prevent individuals from being identified from de-identified information and do not attempt to re-identify it except where reasonably necessary to test whether de-identification controls are effective or where permitted or required by law.

We do not publish identifiable reflection or journal content as research. Any future external research involving identifiable or sensitive information would require appropriate notices, safeguards and consent or other lawful authority.

10) Data retention and account deletion

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Service, maintain security, resolve disputes, comply with legal and financial obligations, and enforce agreements.

Active accounts

Account, profile, wellbeing and feature information may be retained while your account remains active or while needed to provide the feature you requested.

Account deletion

You may request account deletion through the in-app deletion controls where available or by contacting us.

Following a valid deletion request, we may first restrict or disable access and place the account into a deletion period of up to 30 days. This is intended to reduce accidental deletion and may permit recovery where the Service expressly offers that option.

We aim to delete or permanently de-identify personal information in active systems within a reasonable period after the deletion request becomes effective, ordinarily within 30 days, subject to technical processing, lawful retention requirements and the exceptions below.

Restricted residual copies may remain temporarily in backups, logs or disaster-recovery systems until overwritten or deleted through ordinary retention cycles. Those copies are not intended to be used for ordinary Service operation.

Information we may retain

We may retain limited information where reasonably necessary for:

• financial, tax, subscription and transaction records;
• legal acceptance and consent records;
• security, fraud prevention and abuse investigation;
• privacy complaints, disputes and legal claims;
• compliance with legal, regulatory or App Store obligations; and
• limited records needed to verify that an account deletion or other privacy request was completed, which may include the former Bubbles account identifier, email address, authentication-provider category, original account-creation date and time, and deletion-request, purge and completion dates and times.

Deletion audit records. After an account is permanently deleted, we may retain a limited deletion audit record so that we can confirm that the deletion was completed, distinguish a deleted account from a later account created using the same email address, respond to deletion or privacy enquiries, maintain security, and meet applicable legal or compliance obligations. This record does not include deleted check-ins, reflections, guided-support history, profile content, health information, Apple authentication tokens or Apple user identifiers, or other deleted account content. We retain this limited record only for as long as reasonably necessary for those purposes, after which we delete or permanently de-identify it.

Where information is no longer reasonably required and no lawful retention basis applies, we take reasonable steps to delete or permanently de-identify it.

Local information

Some information may remain on your device until you delete it through Bubbles, clear the app’s data or uninstall the app. Uninstalling the app does not necessarily delete information already stored remotely and does not cancel an active subscription.

11) Security

We use reasonable technical and organisational safeguards designed to protect personal and health information from misuse, interference, loss and unauthorised access, modification or disclosure.

Depending on the system and information involved, safeguards may include:

• encrypted transmission using industry-standard secure connections;
• secure managed cloud infrastructure and storage controls;
• authentication and session-management controls;
• role-based or otherwise restricted administrative access;
• database and service access controls;
• software updates, dependency maintenance and security hardening;
• logging, monitoring and investigation of suspicious or abnormal events;
• backup and recovery measures;
• provider security reviews and contractual protections where appropriate; and
• incident-response and data-breach assessment procedures.

Access to personal and health information is limited to persons and providers who reasonably require it for authorised operational, security, support, legal or compliance purposes.

No internet transmission, device, database or storage system can be guaranteed to be completely secure. You should protect your device, account credentials and email account and notify us promptly if you suspect unauthorised access.

12) Data breaches

We maintain procedures for identifying, containing, assessing and responding to suspected data breaches.

Where the Notifiable Data Breaches Scheme applies and an eligible data breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by law.

Where the Health Records Act 2001 (Vic) or another health-information obligation applies, we will also consider any applicable notification, complaint-handling or regulatory requirements, including engagement with the Victorian Health Complaints Commissioner where appropriate.

13) Your choices and controls

A. Account and profile information

You may be able to review or update selected profile, preference and account information in Bubbles. Contact us where the information cannot be corrected through the app.

B. Health permissions

You may enable, disable or change health access through Bubbles settings and through your device or connected health-service settings. On iOS, health permissions can be managed through the Apple Health app or iOS Settings.

Disabling health access may limit or disable Health Context and related features.

C. Notifications and reminders

You can control Bubbles notification permissions through device settings and may be able to manage reminder preferences in the app. Disabling notifications does not delete reminder or account information already stored.

D. Analytics and diagnostics

Some limited diagnostics may be necessary to maintain security, prevent fraud and diagnose failures. Where an analytics or diagnostic activity is optional and a control is available, we will provide the control through the app, website or device settings.

E. Account deletion and export

You may request account deletion through the app where available or by contacting us. Where an export feature is available, you should export information you wish to retain before deletion.

14) Marketing communications

Bubbles may offer optional marketing communications such as:

• newsletters and wellbeing content;
• product and feature updates;
• referral-program information;
• special offers, promotions or complimentary-access opportunities; and
• surveys, research invitations or community updates.

We will only send marketing communications where we have your consent or another lawful basis. Where express consent is used:

• the marketing choice will be separate from acceptance of the Terms and Privacy Policy;
• the choice will not be selected by default;
• marketing consent will not be required to create an account or use Bubbles; and
• you may withdraw consent at any time.

We may record your marketing preference, the date and time of consent or withdrawal, the method through which consent was obtained, and the version of the consent wording or Privacy Policy presented.

Marketing emails will include a clear and functional unsubscribe method. We will process unsubscribe requests within the period required by applicable law.

Opting out of marketing does not prevent us from sending essential service communications, such as:

• password-reset and account-verification messages;
• security and privacy notices;
• subscription, purchase and entitlement information;
• account-deletion updates;
• material changes to legal terms; and
• other communications necessary to provide or protect the Service.

Essential communications will not be used as a means of avoiding your marketing preference.

15) Access, correction and privacy requests

Subject to applicable law and permitted exceptions, you may request:

• access to personal information we hold about you;
• correction of information that is inaccurate, out of date, incomplete, irrelevant or misleading;
• deletion or de-identification of eligible information;
• withdrawal of a consent;
• information about how your information has been handled; or
• a copy or export of information where the Service supports it or applicable law requires it.

To protect privacy and account security, we may need to verify your identity or authority before acting on a request.

We may refuse or limit a request where permitted or required by law. If we do, we will provide reasons where required.

Requests may be sent to help@mybubbles.com.au.

16) Privacy complaints

You may make a privacy complaint by emailing help@mybubbles.com.au or writing to the address in section 22.

Please include:

• your name and contact details;
• the account or reference information relevant to the complaint, where available;
• a description of what happened and when;
• why you believe your information was mishandled;
• the impact on you; and
• the outcome you are seeking.

We will acknowledge and investigate the complaint and aim to provide a substantive response within 30 days. If more time is reasonably required, we will let you know.

If you are dissatisfied with our response, or we do not respond within a reasonable period, you may be entitled to complain to:

• the Office of the Australian Information Commissioner: https://www.oaic.gov.au/privacy/privacy-complaints; and
• where the Victorian Health Records Act or health-complaint jurisdiction applies, the Victorian Health Complaints Commissioner: https://hcc.vic.gov.au/.

17) Mobile app information

The native Bubbles mobile app may collect account, wellbeing, health, subscription, device, usage and diagnostic information as described in this Policy.

The native app does not use ordinary website cookies in the same manner as a web browser. Mobile operating systems, App Store Providers and app service providers may use device identifiers, local storage, software-development kits or similar technologies for authentication, security, subscriptions, diagnostics and app functionality.

We do not permit mobile advertising technologies to use health information or private reflection content for advertising.

18) Website cookies and analytics

When you use the Bubbles website, we may collect:

• IP address and approximate network location;
• browser, device and operating-system information;
• pages viewed and referral information;
• website performance, error and security logs;
• information submitted through forms; and
• cookie or analytics information where those technologies are enabled.

The website may use strictly necessary cookies or similar technologies for security and functionality. If analytics cookies or similar optional technologies are used, they may help us understand website traffic and improve content and performance.

You can control cookies through your browser settings. Blocking necessary cookies may affect website functionality.

We do not sell website visitor information or use private Bubbles health and reflection information for cross-site targeted advertising.

19) Third-party links and services

Bubbles and our website may link to or integrate with third-party websites, services or platforms. Their handling of personal information is governed by their own privacy policies and terms.

We do not control third-party privacy practices and are not responsible for their independent acts or omissions. A link or integration does not necessarily mean that we endorse the third party.

20) Adults only

Bubbles is intended for adults aged 18 years and over and is not directed to children.

We do not knowingly collect personal information from a person under 18 through an account they are not permitted to use. If you believe a minor has provided personal information to Bubbles, contact us so we can investigate and take appropriate action.

21) Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to the Service, our information practices, technology, providers or applicable law.

The “Last updated” date will show when this Policy was most recently revised.

If a change is material, we may provide additional notice through the app, website, email or another appropriate method. Where applicable law requires consent to a new collection or use, we will request that consent before beginning that activity.

22) Contact us

For privacy questions, requests or complaints, contact:

Xiaoshuai Song trading as Songable Studio
ABN: 89 831 726 266
PO Box 2040, Brunswick East, Victoria 3057, Australia
Telephone: +61 457 060 286
Email: help@mybubbles.com.au
Website: https://mybubbles.com.au/